T-Digest (3.1 - 3.3)

The MergingDigest.fromBytes method in t-digest versions 3.1 through 3.3 fails to validate centroid means during deserialization, allowing attackers to inject NaN values that trigger a denial-of-service via algorithmic complexity degradation.